As per WP 11871 I updated the x509 certificates for the local ldap servers. This is regular maintenance and should not have been noticed by any users. I updated the secondary system first and found some puppet issues that I fixed before updating the other servers. This mainly involved putting the CA certificate chain in the certificate file for the slapd process.